Credit crunch- lessons for Kenyan banks' risk management

Imho, the genesis of the current West financial crisis is the deregulation of financial services in 1970s and 1980s that allowed financial entities into activities they were previously barred from. As an example, Barclays could move from retail to investment banking. However, the skillset required to manage a retail vs. an investment bank is like chalk and cheese. Banks then started off-shoring risk in their banking or even trading books e.g. by bundling loans and offering them as collateral in exchange for loans from other financial firms. From the late 80s/early 90s financial firms then offered insurance against these bundled loans using credit derivative swaps. Infact, almost every type of risk was managed via an invented form of derivative. Factor in globalisation; the emergency of the APAC nations and a benign interest rate regime. All this took place within 20 years and risk managers and senior managers generally either couldn't or didn't keep pace with the changes although the generally bullish conditions presumably fooled some. Finally, too many banks exclusively relied on either international rules on risk (Basel accords) or what regulators stipulated. In other words, they outsourced risk management.

Risk management is very straightforward;

1. Based on your understanding of the business your entity undertakes, identify the risks it faces.
2. Measure these risks in terms of the potential monetary impact on your bank's capital/liquidity and profitability.
3. Monitor these risks.
4. Set up ways of controlling these risks. To be clear, banks as with other walks of life, will always face risks. Control entails expressing your risk limits/appetite and putting controls in place to keep within the said limits.

Where an entity doesn'tdo any of the above to a satisfactory degree, nothing (sophisticated VaR models, stress testing and scenario analysis; layers upon layers of risk management cadres) will prevent failure due to one type of risk or the other. Unwary risk management meant that Northern Rock and Lehman Brothers and others fell over whilst ticking all the boxes on capital adequacy as dedicated by Basel 2, whilst neglecting liquidity risk. Failure of risk/senior managers to keep pace with the changing dynamics of its fast growth, led to Northern Rock's failure. The complexity of Lehmans' business and legal structure meant a Tsunami was not seen in good time.

Similarly, lax risk management can also be in CBK's risk survey undertaken in 2010;

-30% of Kenyan banks didn't have a centralised risk function (so nobody apart from perhaps the CRO) knows the overall risks faced by their bank.

-to compound the above, 58% of the banks don't have a head of risk i.e. nobody to take senior responsibility for risk management.

-Just over half of Kenyan banks reviewed their risk management manuals annually. This in a very fast changing industry. Think mobile banking, internet banking, agency banking, branch growth, regional expansion, increased fx/interest rate risk, money laundering laws to name but a few.

-7 banks didn't have a dedicated MIS for risk and another 9 only collected risk MI on an annual basis. So 16 banks couldn't tell you what risks they faced at any given time.

-16 banks didn't think they needed to make any changes to their risk management practices...

When things are going well (straight growth in year on year profitability), its easy to take your eye of the ball, but remember, its only when the waves go out, that we know who is naked.

Aligning bank's size to the economy

After you've

• set required capital ratios
• asked banks to holds capital against every balance sheet
• hold the right type of capital- unencumbered permanent share capital
• request a "will"
• request banks' single counterparty exposure be limited to a multiple of capital

You still won't have tackled the largest elephant in the room so to speak. That is banks that are so large that you don't want them to fail because the cost of rescuing is too prohibitive. Socially, financially, economically locally and maybe even globally, these banks become a threat with economies of scale outweighed by externalities.

The answer is a removal of a one-size fits-all and move to a more dynamic capital adequacy system. Regulators and governments set minimum capital requirement with reference to the growth in the banking industry's lending as a proxy for the economy.

But then for banks that are growing, you require that they adjust their capital ratios in line with year on year the growth of their balance sheets. Similarly, those that particularly large should have higher capital ratios.

The methodology is intuitive and can be applied even to simple regulatory systems like Kenya's. i.e. while each bank must have a Ksh1bn plus, those that are growing fast or the top 10 should hold higher capital Ksh2bn and the top five Ksh3bn or higher capital ratios.

Is the falling NSE a blessing in disguise?

You either make the change, get ready for change or change will sweep you away. For years now, investors have agitated change at the NSE that brings about:

• integrity in transactions
• dynamism in reacting and adapting to changing technology
• customer service
• liquid bourse
• strong institutions either controlling or regulating the bourse
• no conflicts of interest
• no political-business affliations
• a decent economic thermometer...
• leading to strong brokers, investment banks
• informed investors
• and a viable saving and investment vehicle

But wapi? We seem to be stuck in a timewarp where we go forward two steps and slowly go back to step one again. Strong measures such as those on disclosure, capitalisation and ownership are only adapted under extreme duress.

We motored between 2002 and 6, but within that period, managed to sow some destructive seeds that we've been harvesting ever since.

Its notable that every time we've had a dip, one or two brokers have said sayonara. FT went out after the Feb '07 dip, Nyaga survived but hobbled throughout 2007 by Mumias' 2nd IPO but succumbed when money ran out after the clashes in early 2008. 2007 also accounted for Solid Investment.

The 2008 bear has accounted for Discount, Crossfields and possibly Suntra. I believe this is the tip of the iceberg. If we went to 2,000, I think we would probably bring Reliable, Sterling, AIB, Ngenye into the net.

Most of these have one or two of the following in common; malpractices, leveraged business model, or operational risks galore. And unlike in some markets where firms react to worries about their "going concern" status by opening their accounts, at the NSE all you hear is typical "deny deny everything".

We need to sweep away the deadwood and hopefully come out of the otherside with strongly anchored brokers either via strong shareholding and governance structures or by being absorbed banks...

Time for Kenya Financial Regulator is Now

:-3 brokers in two years and several others requiring shotgun weddings to avoid going the same way.

:-Much needed reform in the trading environment with security of investors' funds, trasding that is behind times, largely uneducated investor community, low confiendence. Confusion and opposition about capaital requirements when everwhere else, people seem to know what time it is...

:-Banking behind times in some ways (basic banking accounts and lending rates are uncompetitive); the unbanking population is reducing very slowly. Confusion about capital requirements when the world and his mother recognise the importance of strongly capitalised

:-Insurance sector that survives in part due to very good business savvy rather than strong and well regulated environment. Insurance penetration levels are very low as a result (2.6% compared to 14.6% in SA and 3.7% in India.

:-2007, new capital targets for Banks and Insurers are set before Bunge. They get shot down. 2008 similar targets for brokers and IBs are announced.

:-Isn't time we had an independent body bringing together the various financial sub-sectors and able to give streamlined common sense coherent regulation for the sector as a whole?

Some features:

• Chairman: to steer policy, public dissemination and generally be a strong voice for the sector in and out of Kenya. We could start with a current CEO of one of the large banks to give the correct take-off.
• Clear regulation framework and underpining policy that is easily understandable to the financial sector and key stakeholders (investors, business and GoK). This would spell out among others, capital adequacy and liquidity requirements over an economic cycle; reporting requirements; how the firms will be supervised; expactations around management structure and corporate governance; risk management and measurement tools.
• Clearly spelt out targets on consumer education rather than nice sounding words especially around charges; consumer rights and complaints procedures.
• Oversight from the Parliament Committee for Finance

Setting up bank branches in the West just got harder

Up until the latest economic crisis in Kenya engendered by the events of January yesteryear, several banks were thinking of having small operations in the UK or in the US to tap into the diaspora. In theory, I didn’t think this was necessary. I for example never needed to go to Kenya to open my online bank account with Equity. However, KCB had for example explored this seriously and Equity is apparently thinking of doing so in Baltimore (?).

Time for a re-think...

From October, any UK-based has to in effect be self-sufficient in terms of liquidity. Other nations will also follow suit. What does this mean? In addition to the fairly onerous capital commitment, banks operating in all G10 and other signatories to Basel 2 will in effect have to demonstrate that in normal and stressed situations, their operations can withstand any cash flow requirements either to hand or from funding that is easily accessible. Sounds simple but one thing the regulators don’t want to hear is that especially in periods of stress, your operations will be dependant on parent bank to provide liquidity. The credit crunch has demonstrated that this doesn’t happen (Iceland banks, Lehman Brothers all swiped cash into home territory as soon things went pear-shaped).

You in effect need to demonstrate that this will be a stand alone banking business...

Kenyan Banks & BASEL II: Implementation

Why is it important for Kenyan banks to adopt Basel 2 in its entirety?

1. Growth: Any bank looking to grow domestically and internationally will need robust and scalable risk management systems and processes. As it grows, it'll notice different types risks e.g. market risk (fx and interest rate exposures) for international banks; for a domestic bank that is growing, its branch mangers will no longer have time to relation manage every creditor thus credit risk grows. A bank acquiring a broker for example opens itself to huge operational and market risks (proprietary equity positions).
2. Capital sourcing: For banks that look to source funding from either NSE or abroad; risk management is a consideration for the investors. Having class "A" risk management may reduce the premium that investors require
3. Reputational: the risk of not having risk management in place is that the bank will find its reputation in tatters or worse when one type of risk trips it up.
4. Contigency planning: Part of Basel 2 risk management is stress testing which is about capitalising for one-off capital destroyers.
5. Shareprice: Could be impacted by the feeling that a certain bank is at risk from its reckless risk management. As an investor in Equity, one question I always ask myself is this, if say Equity was to be hit by one of the above risks; was discovered to have insuffcient capital as a result and had to de-scale its operations, would CBK's Ndungu have tell Equity to reduce its operations? And I think we all know the answer to that.

In terms of Implemntation, CBK would like to start implementing Basel 2 from next year so that is our starting point.

Credit Risk:
-The standard approach won’t be applicable unless
---Bank has significant banking book-applies to most Kenyan banks
---Significant corporate or sovereign (including municipalities, parastatals and county council) exposure
---Significant credit rating coverage-very few corporates are credit rated in Kenya and even those that are, very few keep these ratings updated.

This leaves the two internal rating methodologies. In theory, this should mean a quicker uptake by the banks because many should already have these in place, right? Wrong-many are reliant on credit appraisals some which require subjective judgements. The initial credit approval process lacks the scalability that the use of credit scoring system would bring about. Then regulators have to approve these models. Which is where the next comes especially if different banks use different models as opposed to ones within set industry standards. It places a lot of pressure on the supervisor knowledge wise. How do they know which internal model is delivering adequate credit risk coverage? How do you compare an internal model that Equity uses to credit rate its mass customers with that of Standard Chartered which has middle/upper class customers?
Under the Advanced IRB, the bank can use it own model to estimate pd, as well as loss given default, expected loss, maturity, but in most countries this is only allowed if the bank has been producing these estimates for 3 or more years. Most Kenyan banks don't have these internal credit rating models now let alone for 3 years.
Under Foundation internal rating based approach, the bank is allowed to estimate the probability of default. To estimate PD, most banks would need to have the ability to stratify their customers using various criteria but the main ones might be maturity profile, collateral type and repayment track record. Once, the bank is able to break this down into say 10-15 categories, it can attach risk weightings to each category which will in effect denote the capital that needs to be held against each. Being able to get this model signed off by regulators will thus reduce capital required in most cases if the classification is sufficiently granular.

Market Risk:

Most Kenyan banks will have fx and interest rate risks under this risk category and exceptionally, equity. Daily VaR approach requires the bank to be able to calculate the daily P&L impact of a 1 basis point movement in interest rates on its banking book. Similarly for those parts of its banking and trading book that have exposure to non-domicile currencies. The fx risk will thus apply to KCB, DTB, Equity and others that have foreign businesses.

Operational Risk:

This is in effect the easiest to implement because with the exception of the advanced approach, most banks should be able to get data by business lines for several years and this just then need to apply a factor.

Holistic Scenario Testing:
Once the bank is able to calculate the required regulatory capital from the above and other risks, Basel 2 requires that a bank using the internal models in of the approaches to do stress test its capital against various one-off scenarios. For most Western banks these are events such as; credit crunch; LTCM, the tech bubble burst; oil prices crisis; black Monday et al. In Kenya, banks should consider the likely impact on their regulatory of the following scenarios and then provide the necessary capital buffer:

• A coup overthrowing current government
• Civil war lasting 6 months
• Drought lasting 1 year
• A run on the bank
• IMF/WB sactions against Kenya
• Withdrawal of a shareholder
• Arresting of CEO for murder
• Security breach on internet facility
• NSE fall by 50% in 7 days
• Global depression

Kenyan Banks and BASEL II: Review

At its heart, the current credit crisis is about reckless risk management, failure of risk management regulation and credit ratings...
Basel2 is in my humble opinion one of most complete approaches to risk management designed for the banking industry or any other industry. So what is it and how would it affect Kenyan banks were they to adopt it?

The Basel (Basle) in Basel II is the name of a Swiss town where bank international settlements are done. Its the son of Basel I, which was created back in 1988 as a recognition by the G10 nations plus two other nations that banks required a common approach to risk (credit & market) management and capital set aside to mitigate that risk. Being an initial effort, it was very broad brush and BII was therefore designed to add detail in terms of credit and market risks; cover off other risks (specifically operational risk) and other issues such as disclosure and regulation.
All these facets are covered in 3 pillars. For each of the 3 key banking risks (credit, market and operational), BII recommends a menu of approaches that banks and their regulators can adopt, but importantly specifics for each sub-type of business.
Credit risk: Risk that borrower (counterparty in banking-speak) defaults.The trio of approaches are :
(i) standard: allocate capital based on credit rating of counterparty;
(ii) internal rating-based- where bank uses regulator-sanctioned internal ratings models. Can either be foundation IRB i.e. just use internal model to estimate probability of default
or Advanced IRB where bank is allowed to use its model to estimate PD as well as loss given default and exposure at default.
Market risk: Risk from changing market factors(interest /fx rates; share/commodity prices). VaR for value at risk is the preferred approach.
Operational: Risk arising from banks’ way of doing things. BII recommends either basic indicator approach i.e. capital set aside must be the average of last 3 yrs annual gross income OR standardised approach which divides banks business into 8 different lines, takes their gross income and multiplies with a beta factor OR advanced measurement approach where the bank can use its own model.
The other two pillars deal with how the regulatory approach and in particular ICAAP which is the internal capital adequacy assessment process covering the bank’s approach to pillar 1 risks and other risks and disclosure of the same.

In terms of impact of regulatory capital, the experience in G10 nations has been that capital required is either the same or lower because banks can leverage broad credit rating coverage or strong internal models. As you’d expect, there have been criticisms of Basel II, but most have actually focused on what went wrong to spark the current credit crunch namely very ropey credit ratings and regulators evaluation of internal models used by banks. So far, many countries have taken up Basel 2.

In Africa, South Africa is far ahead having started using B2 in Jan 2008. In most other countries, B2 is only mentioned in passing. However, as a general rule, those nations with presence of international subsidiaries stand a better chance of early adoption. As do those with banks interested in going abroad. To bridge the knowledge and resource gap, some like Egypt are sourcing help from EEC. Adaption is now seen as given banks a competitive advantage.
Turning to Kenya, CBK has handily released a survey of 31 of our banks showing their awareness, intent, understanding and preparedness towards adopting Basel2. The survey fitted neatly with a review I was doing of how the listed banks do risk management. BDA has focused on the so-called talent war but there is a lot of other issues.
Here are my salient points:

• CBK wants to start adopting Basel II from 2010
• Banks have not yet adopted Basel1 wholly e.g. none actually allocates capital against market risk
• Awareness of BaselII is medium, less 5 than have done any assessment for B2 purposes
• Only 5 banks have in place a Basel II steering process
• The 7 subsidiaries of international banks were ready to adopt Basel II from 2008
• Only 3 local banks had any budget for Basel II in 2008
• CBK does not yet do risk-based supervision of the banks-uses Prudential rules
• BII is not seen as a competitive tool-parochial view
• Only 5 of the 31 deal in any non-plain vanilla financial instruments
• In UK, most banks took 2 to 3 years to prepare
• For credit and operational risk where there is a menu of approaches on offer, most prefer internal models
• Majority of local banks have an IT and human resources constraints (hence the BDA headline)

From annual reports, KCB seems to be ahead of the game in terms of its coverage of Basel II ( it was the first to appoint a CRO, already calculates probability of default and Temenos, its new IT system will at least give it the centralised banking data view)

Next post will look at the implementation process for Kenyan banks...